S-215 



EXPRESS MAIL LABEL NO.: EU475485649US 



SECURE FRANKING MACHINE 

BACKGROUND OF THE INVENTION 
[001 ] The invention relates in particular to a franking machine. 
[002] The problem of securing "sensitive" data consisting of franking data or 
marks arises in the field of franking machines. 

[003] In this type of machine, it is essential to secure data generated by a unit for 
generating franking data and sent to a printer unit (for example a printer) for the data 
to be printed by a print member, such as a printer cartridge, which includes an ink 
reservoir provided with a print head. 

[004] For example, if the data is not secure, a fraudster can intercept it between 
the data generating unit and the printer unit, or even within the printer unit itself. Thus 
when a franking mark of value X should be printed on an envelope, the fraudster can 
replace that mark by a franking mark of value Y greater than X. 
[005] Thus the management unit decrements its counter of franking values 
delivered to the printer unit by only an amount X when in reality a greater amount has 
been printed. 

[006] Various security methods to prevent this are known to the person skilled in 
the art. 

[007] In particular, encrypting the franking data in the management unit, sending it 
in encrypted form to the printer unit, and then decrypting it before sending it to the 
print member is known in the art. 

[008] However, this cannot be done with standard connections between the data 
generating unit and the printer unit. 

[009] Furthermore, a method of the above kind does not eliminate the risk of a 
fraudster intercepting the decrypted data in the printer unit and tampering with it 
before sending it on to the print member. 

[0010] To make the securing of franking data more reliable, a dedicated print 
member could be provided that would include an internal circuit for decrypting data 
and would be inaccessible from the outside, for example a dedicated inkjet printer 
cartridge. 
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[001 1] A solution of the above kind would require specific development of the print 
members (for example inkjet cartridges) and would therefore no longer allow the use 
of products available off the shelf. 

[0012] A solution of the above kind could even lead to modification of the printer 
unit (printer) itself. 

[0013] A solution of the above kind tends to make franking machines more 
complex. 

[0014] It would consequently be beneficial to be able to secure the franking data in 
a franking machine in a simple, inexpensive, and efficient manner. 
[0015] It would also be beneficial to secure the franking data in a franking machine 
without calling into question the architecture of existing franking machines, and in 
particular the printing technology used in the machines. 

[0016] More generally, outside the context of franking machines, there exists a 
need for securing sensitive or confidential data coming from a data source external to 
conventional printing mechanisms that use a printer unit incorporating an inkjet printer 
cartridge. 

[0017] The various aspects of the invention stated hereinabove aim to remedy at 
least one of the drawbacks previously cited. 

SUMMARY OF THE INVENTION 
[0018] In a first aspect, the invention provides a franking machine including a unit 
for generating franking data and a unit for printing data connected to said data 
generating unit and adapted to receive franking data therefrom, said printer unit 
including at least one member for printing data, characterized in that the franking 
machine includes additional means for wireless communicating between the print 
member and the data generating unit to enable identification of the print member by 
the data generating unit. 

[0019] Accordingly, by using additional wireless communication means, the data 
generating unit is able to control the print member and in particular to verify its identity. 
[0020] This ensures that the print member is authorized to receive franking data to 
be printed and thus that it has not been modified or replaced by a fraudster. 
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[0021] For example, the print member supplies authentication data to the data 
generating unit in the case of unidirectional communication. 

[0022] The data generating unit can also look for an identifier of the print member 
in the latter. 

[0023] If the data generating unit does not recognize the print member, it can 
decide not to transmit the printing command to the printer unit or to transmit a 
command to print erroneous or incomplete franking data. 

[0024] If bidirectional communication is possible between the data generating unit 
and the print member, the data generating unit can decide to send a blocking 
command to the print member that causes it to interrupt the printing of data. 
[0025] Note that the additional wireless communication means do not call into 
question the standard connection between the data generating unit and the printer unit 
that is used to transmit franking data to the latter unit. 

[0026] Thus this aspect of the invention does not necessitate a specific connection 
between the above elements to implement the invention. 

[0027] According to one feature, the wireless communication is effected by means 
of radio waves. 

[0028] According to one feature, the print member includes at least one 
identification tag that communicates data identifying the print member by radio waves 
to the data generating unit when an electromagnetic field is applied to it. 
[0029] According to one feature, the identification tag is flexible, i.e. it bends easily. 
[0030] According to one feature, the identification tag includes a substrate 
permanently fixed to the print member and communication means on the substrate. 
[0031] According to one feature, the data generating unit includes an 
electromagnetic field source. 

[0032] According to one feature, the data generating unit includes a circuit for 
receiving identification data. 

[0033] According to one feature, the print member is an inkjet printer cartridge 
including at least one print head. 

[0034] In a second aspect, the invention provides an inkjet printer cartridge for 
printing data, characterized in that it includes at least one tag identifying the cartridge 
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that communicates identification data to the outside by radio waves, when an 
electromagnetic field is applied to it, the identification tag including a substrate fixed to 
the cartridge and communication means on the substrate. 

[0035] Thus a printer cartridge can be identified remotely without necessitating 
contact or a physical connection. This provides a simple way to check that the printer 
cartridge is an authentic cartridge and has not been replaced by a fraudster. 
[0036] This aspect of the invention is useful when sensitive or confidential data 
must be sent to the printer cartridge by an external data source via the printer unit that 
incorporates the cartridge. 

[0037] This is because the identity of the cartridge is checked beforehand by 
applying an electromagnetic field to it, and this thus makes the printing mechanism 
more secure by preventing the sending of sensitive or confidential data systematically. 
[0038] Simply affixing a radio identification tag to an off-the-shelf inkjet printer 
cartridge contributes to making the cartridge, and thereby all of the printing 
mechanism, reliably secure, without calling into question the printing technology, and 
in particular without modifying the cartridge itself. 

[0039] According to one feature, the inkjet printer cartridge includes a data 
processing unit which analyzes a stream of printing commands for controlling the print 
head of the cartridge to authenticate the data to be printed. 

[0040] According to one feature, the processing unit includes means for verifying 
the integrity of data to be printed. 

[0041] According to one feature, the data processing unit is a miniature unit 
attached to a thin and flexible printed circuit that is fixed permanently to the printer 
cartridge. 

[0042] According to one feature, the substrate of the identification tag is 

permanently fixed to the cartridge so that any subsequent attempt to remove the 

substrate damages its communication means. 

[0043] According to one feature, the identification tag is flexible. 

[0044] According to one feature, the identification tag contains main identification 

data. 
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[0045] According to one feature, the identification tag contains secondary 
identification data relating to the use of the cartridge in a franking machine. 
[0046] The second aspect of the invention also encompasses the use of the above 
inkjet printer cartridge in a unit for printing data. 

[0047] This aspect of the invention is particularly beneficial in the field of franking 
machines that include a unit for printing data on a support. 

[0048] In a third aspect, the invention provides a franking machine including a unit 
for generating franking data and a unit for printing data connected to said data 
generating unit and adapted to receive franking data therefrom, said printing unit 
including at least one member for printing data, characterized in that the franking 
machine includes: 

[0049] means for obtaining data enabling identification of the print member by the 
data generating unit in a first communication mode, 

[0050] means for generating a signature of the franking data by the data generating 
unit, 

[0051] means for encrypting the signature of the franking data by the data 
generating unit, 

[0052] means for sending the franking data and the encrypted signature to the 
printing unit in a second communication mode, and 

[0053] means for decrypting the encrypted signature by the print member. 
[0054] In a correlative way, the invention also provides a method of securing data 
in a franking machine that includes a unit for generating franking data and a unit for 
printing data connected to said data generating unit and adapted to receive franking 
data therefrom, said printing unit including at least one member for printing data, 
characterized in that the method includes the following steps: 

[0055] obtaining data identifying the print member in a first communication mode 
by the data generating unit, 

[0056] generating a signature of the franking data by the data generating unit, 
[0057] encrypting the signature of the franking data by the data generating unit, 
[0058] sending the franking data and the encrypted signature to the printing unit in 
a second communication mode, and 
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[0059] decrypting the encrypted signature by the print member. 

[0060] In accordance with this aspect of the invention, data is printed in a secure 

way in existing franking machines using a given printing technology. 

[0061] To this end, the print member is authenticated by obtaining its identifier. 

[0062] Furthermore, there is provision for generating a signature in the data 

generating unit and sending franking data with the signature in encrypted form to the 

printing unit, which then sends them to the print member for decrypting. 

[0063] The print member is capable of decrypting the encrypted signature and 

therefore of authenticating or not the source of the data. 

[0064] Thus the data is made secure in a simple and reliable manner. If the print 
member cannot decrypt the signature, or does not find it, or decrypts a signature that 
is not that of the authorized sender, this indicates tampering upstream of said 
member. 

[0065] In this case, if printing of the data has begun, the print member interrupts 
printing or allows it to continue but introduces erroneous data. 

[0066] According to one feature, the print member includes means for 
authenticating franking data. 

[0067] According to one feature, the print member includes means for verifying the 
integrity of the franking data. 

[0068] According to one feature, the print member includes at least one tag 
identifying said print member which communicates data identifying said member to the 
data generating unit by radio waves when an electromagnetic field is applied to it. 
[0069] According to one feature, the identification tag includes a substrate fixed 
permanently to the print member and communication means on the substrate. 
[0070] According to one feature, the data generating unit includes a circuit for 
receiving identification data. 

[0071] According to one feature, the data generating unit includes an 
electromagnetic field source. 

[0072] According to one feature, the decrypting means of the print member have a 
prior knowledge of data identifying said print member. 
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[0073] According to one feature, the print member includes a data processing unit 
that includes the decrypting means. 

[0074] According to one feature, the decrypting means are fixed to a thin and 
flexible printed circuit that is fixed to the print member. 

[0075] According to one feature, the data processing unit is fixed to a thin and 
flexible printed circuit that is fixed to the print member. 

[0076] According to one feature, the print member is an inkjet printer cartridge 
including at least one print head. 

DESCRIPTION OF THE DRAWINGS 
[0077] Other features and advantages will become apparent in the course of the 
following description, which is given by way of nonlimiting example only, and with 
reference to the appended drawings, in which: 

[0078] Figure 1 is a diagrammatic representation of the architecture of a franking 
machine according to the invention; 

[0079] Figure 2 is a diagrammatic view of an identification module 58 of a print 
member according to the invention; 

[0080] Figures 3a and 3b are diagrammatic views of two opposite faces of an 
intelligent module 54 of a printer cartridge according to the invention; 
[0081] Figures 4a to 4h show successive operations of fitting out a printer cartridge 
according to the invention; 

[0082] Figure 5 is a diagrammatic view of the data processing unit of the Figure 3 
intelligent module 54; 

[0083] Figure 6 is a more detailed view of the unit 68 of the Figure 5 data 
processing unit; 

[0084] Figure 7 is a detailed diagrammatic view of the self-powering unit 92 from 
Figures 5 and 6; and 

[0085] Figure 8 shows timing diagrams of various signals for generating a self- 
powering signal Vout. 
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DETAILED DESCRIPTION 
[0086] The embodiment shown schematically in Figure 1 represents the general 
architecture of a franking machine 10 according to the invention. 
[0087] This machine generally includes two entities: a unit 12 for generating 
franking data and a unit 14 for printing data that receives franking data from the unit 
12 in order to print it, for example in the form of a franking mark 16 on an envelope 17. 
[0088] To be more specific, the unit 12 has the following functions: 
[0089] composing the franking mark; 

[0090] sending data to be printed to the printer unit 14 (scheduling printing of the 
franking mark); 

[0091] managing accounting data, in the sense of managing the totalizing counter 
of franking amounts and imprint counters; 

[0092] checking the consistency of the accounting data, which ensures the 
reliability of the data record for each franking cycle; and 

[0093] guaranteeing the integrity, confidentiality and availability of the accounting 
data. 

[0094] As shown in Figure 1 , the unit 12, also known as a meter, includes a central 
data processing unit 18 that communicates with a module 20 including a cryptographic 
circuit 22 containing the algorithm or algorithms necessary for encrypting data, a fraud 
detector circuit 24 which, for example, detects attempted opening of the cover of the 
franking machine, for example, by means of mechanical or optical contacts, for 
example, and a CSP circuit 26 that is informed of attempted fraud by the circuit 24 and 
then deletes critical data such as the encryption keys or algorithms, for example. 
[0095] The unit 12 also includes a modem 28 enabling the postal services to read 
the meters of the franking machine by telephone, for example for billing purposes. 
[0096] The central unit 18, which includes in particular a processor or 
microprocessor, also communicates with scales 30 for weighing postal packets to be 
franked. 

[0097] Figure 1 also shows other external devices, for example a device 32, such 
as an electronic circuit card (PC option), for example, for emulating the man-machine 
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interface (MMI) 36 integrated into the franking machine 10, and which conventionally 
includes a keyboard and a screen (not shown). 

[0098] The unit 12 for generating franking data communicates with the printer unit 
14 via a USB connection 38, for example. 

[0099] Data and signals are exchanged between the other components of the 
franking machine and with external devices via cable connections. This is known in 
the art. 

[00100] The central unit 18 communicates in particular with the module 20, the 
external devices 30, 32, and the man-machine interface 36 via cable connections. 
[00101] The printer unit 14, which is a printer, for example, includes a printing 
control module 40 which receives from the unit 12 a stream of franking data to be 
printed and an encrypted signature 42 and converts the data received into a stream of 
printing commands 44 that is then sent to one or more print members 46 for printing 
franking data in the form of the franking mark 16. 

[001 02] To be more specific, the print member 46 is a printer cartridge that includes 
an ink reservoir 48 and a print head 50 for printing data (Figures 1 and 4a). 
[00103] The commands for printing the stream 44 control the print head 50 for 
printing the franking mark 1 6 on the support 1 7. 

[00104] The print member 46 is rendered intelligent by the presence of a module 54 
affixed to it and described in more detail later. 

[00105] The franking machine 10 further includes additional wireless communication 
means between the print member 46 and the unit 12, enabling the latter to identify 
said print member. 

[00106] To be more specific, the unit 12 includes a sender module 56 and the 
printer unit 14 includes a receiver module 58 affixed to the print member 46. 
[00107] In this embodiment, wireless communication between the unit 12 and the 
print member 46 is performed via radio waves. 

[001 08] The module 58 sends data identifying the print member to the unit 1 2. 
[00109] In this embodiment, the module 58 is a tag identifying the print member 
which communicates its identification data by radio when acted on by an 
electromagnetic field whose source is in the module 56. 
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[00110] When the module 56 wishes to identify a print member in order to check 

that it is an authorized print member, it then generates a constant magnetic field 

directed to the module 58 of the print member 46 and, by means of a receiver circuit, 

measures variations in the magnetic field generated by the module 58. 

[00111] The module 58 amplitude-modulates the electro-magnetic signal, so to 

speak. 

[00112] Thus measuring the variations of the electromagnetic field provides data 
identifying the print member and therefore enables the nearby print member to be 
recognized or not. 

[00113] This recognition procedure is carried out before the unit 12 for generating 
data sends franking data to the printer unit 14 for printing. 

[001 14] Note that the frequency of the electromagnetic waves emitted by the module 
56 is 13.56 MHz, for example. 

[00115] This remote communication and identification technology is known as radio 
frequency identification (RFID). 

[00116] Note that the module 56 may require to write data in the identification 
module 58 and to this end the amplitude modulation of the electromagnetic signal is 
then generated directly by the module 56 itself. 

[001 1 7] Note also that the identification tag 58 is known as an RFID tag. 

[00118] To be more specific, the module 56 is, for example, an electronic 

component commerzialized by Texas Instruments under the commercial reference HF 

reader system series 6000 S6700 Multi-protocol Transceiver IC. 

[00119] This kind of component, also known as a transponder, manages the 

exchange of data and signals between the identification tag 58 and the transponder 

itself. 

[00120] The identification tag is, for example, commerzialized by Texas Instruments 
under the reference Tag-It HF-1 Transponder Inlay Rectangle - Miniature. 
[00121] This component has a memory space of 2 kbits accessible in read mode 
and in write mode and contains for each component a unique identification number 
(main identification data) that is accessible only in read mode. 
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[00122] Once the identifier has been stored in the tag, it is therefore no longer 
possible to modify it. 

[00123] When the tag is affixed permanently to a print member, the identifier of the 
tag constitutes a unique identifier of the print member itself. 

[00124] The identification tag also contains secondary identification data that 
relates, for example, to the use of the cartridge in a given application, i.e. in a franking 
machine in the embodiment described here. 

[00125] In the context of using the printer cartridge in a data printer unit of a franking 
machine, secondary identification data can be specific to the franking applications, for 
example. 

[00126] Figure 2 shows highly schematically an identification tag used in the Figure 
1 franking machine 10. Note, however, that a tag of this kind intended to be affixed to 
an inkjet printer cartridge provided with a print head can be used outside the field of 
franking machines, more generally in printer units that receive confidential and/or 
sensitive data from external devices. 

[00127] The presence of the identification tag on a print member of a printer unit of 
the above kind secures the printing of confidential and/or sensitive data in that 
authorization to print such data is accorded only if the print member has been 
identified unambiguously, by means of its identification tag, during a recognition 
procedure executed between the source of the confidential and/or sensitive data and 
said print member. 

[00128] Referring again to Figure 2, the identification tag 58 includes a substrate 60 
that is thin and flexible, i.e. one that bends easily, on which are provided radio 
communication means constituting the communication function of the identification 
tag. The communication means consist of an integrated circuit 62 that implements the 
send and receive function and an antenna 64 that picks up the magnetic field. 
[00129] In the above example of an identification tag the antenna 64 is at the 
periphery of the substrate 60, for example. 

[00130] Figures 3a and 3b show diagrammatically the module 54 constituting the 
onboard intelligence of the print member. 
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[00131] The module 54 takes the form of a thin double-sided printed circuit that is 
flexible, i.e. one that bends easily, to which is attached a thin miniature data 
processoring unit 68. 

[00132] The total thickness of the thin circuit 66 and the processoing unit 68 must be 
sufficiently small that, when the intelligent module 54 is fixed to a standard inkjet 
printer cartridge 46, as described hereinafter with reference to Figures 4a to 4h, the 
bulk of the cartridge equipped in this way does not compromise the installation of the 
cartridge in the standard printer unit for which it is intended. 

[00133] It is important that, when integrated into the printer unit, the printer cartridge 
forms with the components of the printer unit sufficient space to accommodate the 
circuit 66 equipped with the data processing unit 68. 

[00134] The total thickness of the circuit 66 and the unit 68 is less than 1.5 mm, for 

example, enabling it to be integrated with a very large number of inkjet printer 

cartridges without modifying the geometry of the cartridge and its support. 

[00135] The thickness of the data processing unit 68 is around 1 mm, for example 

(e.g. 0.9 mm), and that of the circuit 66 is less than 0.2 mm, for example. 

[00136] However, for some applications where the overall size constraints relating to 

the installation of the cartridge on its support are less severe, a total thickness of the 

circuit 66 and the unit 68 from 1 .5 to 2 mm can be envisaged, for example. 

[00137] As shown in Figure 3a, the circuit 66 includes on a front face a plurality of 

electrical contact areas 70a to 70k adapted to communicate with the processing unit 

68 via respective conductive tracks 72a to 72k. 

[00138] The contact areas 70a to 70k therefore receive the stream of printing 
commands 44 from the Figure 1 printing control module 40 and send it to the 
processing unit 68. 

[00139] As shown in Figure 3a, the circuit 66 includes a plurality of conductive tracks 
that run from the processing unit 68 (in the bottom left-hand corner) to the opposite, 
rear face of the double-sided circuit, which is shown in Figure 3b. 
[00140] The circuit 66 has on the rear face a plurality of electrical contact areas 73a 
to 73k which are connected to the processing unit 68 via respective conductive tracks 
75a to 75k that are partially represented in the left-hand portion of Figure 3a and 
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adapted to come into contact with the corresponding electrical contact areas 79 on the 
standard printer cartridge 46 shown in Figure 4a. 

[00141] Accordingly, after having analyzed the stream of printing commands 44 
received via the electrical contact areas 70a to 70k, the processing unit 68 sends the 
commands successively via the conductive tracks 75a to 75k, the electrical contact 
areas 73a to 73k, and the corresponding electrical contact areas on the Figure 4a 
printer cartridge, until they finally reach the print head of the cartridge, in order to 
control the printing operation. 

[00142] Note that the Figure 3a flexible circuit 66 has two portions that are delimited 
by two facing notches 74 and 76 on two parallel longitudinal edges of the support and 
define a bending line between those portions. As described later with reference to 
Figures 4e to 4h, the bending line allows the module 54 to be installed on two different 
regions of the exterior surface of the printer cartridge. 

[00143] The printed circuit 66 has a first portion 67 carrying the electrical contact 
areas 70a to 70k and a second portion 69 carrying the processing unit 68. 
[00144] Note that the processing unit 68 is implemented in programmed logic, which 
reduces its energy consumption. 

[00145] The flexible printed circuit is made from a PTF polymer material 
approximately 0.125 mm thick, for example. 

[00146] Note that the PTF technology employed is relatively economical and uses a 
polyester film for the dielectric and a silver-containing conductive ink to produce the 
conductive track previously cited. 
[00147] This technology can produce multilayer circuits. 

[00148] The data processing unit 68 is mounted on the printed circuit 66 by means 
of techniques known to the person skilled in the art for integrating an electronic 
component onto a circuit. 

[00149] For example, the unpackaged component can be integrated into a TSSOP 
approximately 0.9 mm thick. 

[00150] The component protected by its packaging is then transferred to the circuit 
by a technique known to the person skilled in the art and the connecting pins of the 
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packaging are fixed to the conductive tracks of the circuit by a conductive glue which 
is, for example, isotropic. 

[00151] The type of printed circuit used in accordance with the invention that can be 
permanently fixed to a printer cartridge is of the type sold by the company Parlex, for 
example. 

[00152] Figure 4a shows diagrammatically a standard inkjet printer cartridge 46, for 
example a Hewlett Packard HPc665x cartridge. 

[00153] As the person skilled in the art knows, the cartridge contains an ink reservoir 
and a print head 50 with nozzles for ejecting ink onto the support to be printed. 
[00154] As the person skilled in the art also knows, the cartridge has on its exterior 
surface electrical contacts 79 mounted on a thin circuit affixed to the cartridge, the 
electrical contacts being adapted to route the printing control signals to the print head 
to control the ink ejector nozzles. 

[00155] Note that standard cartridges available off the shelf have no onboard 
intelligence and that in this case the printing control signals are therefore transmitted 
to the print head without analysis, in contradistinction to the present invention. 
[00156] As shown in Figures 4b, 4c and 4d, the inkjet printer cartridge 46 shown in 
Figure 4a is fitted with the identification tag previously described (the identification 
module 58 shown in Figures 1 and 2), for example by permanently gluing it to the 
exterior surface of the cartridge. 

[00157] It is important for the substrate 60 of the identification tag to be fixed 
permanently to the cartridge, so that any subsequent attempt to remove the substrate, 
damages the communication means 62, 64 on it. 

[00158] If the communication function of the identification tag is damaged, this 
makes it impossible for the source of confidential and/or sensitive data, for example 
the unit 12 for generating franking data in Figure 1, to identify the printer cartridge 
concerned. 

[00159] The person skilled in the art knows how to fix the substrate permanently to 
the cartridge, for example using glues available off the shelf, suited to the materials to 
be in contact, and providing a particularly intimate contact between the substrate and 
the exterior surface of the cartridge (Figures 4c and 4d). 
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[00160] As can be seen in the Figures, the identification tag 58 can be larger than a 
face 85 of the cartridge. In this case, thanks to the flexibility of the tag, it can be folded 
and one portion of the tag positioned on the face 85 and the other portion folded onto 
one of the adjacent faces 86 of the cartridge. 

[00161] Once again, the identification tag 58 is particularly thin, enabling it to be 
integrated onto the exterior surface of the cartridge without modifying the overall 
external size of the latter to a degree that would compromise the installation of the 
cartridge in a standard printer unit. 

[00162] The constraints on the thickness of the identification tag are the same as 

those previously indicated for the intelligent module 54. 

[00163] The thickness of the tag is less than 1 mm, for example. 

[00164] As shown in Figures 4e to 4h, the Figure 3 printed circuit 66 is permanently 

fixed to the exterior surface of the printer cartridge to prevent insertion of an external 

element between the circuit and the cartridge itself. 

[00165] To this end, the circuit 66 can be glued intimately to the exterior surface of 
the cartridge, for example, so that any attempt to remove the circuit 66 by unsticking it 
damages it and therefore makes it impossible for a fraudster to use the cartridge. 
[00166] More particularly, the second portion 69 of the thin printed circuit 66 carrying 
the data processing unit 68 is first applied to one of the exterior faces 81 of the 
cartridge (see Figure 4f), while the first portion 67, carrying the electrical contact 
areas, is applied to an adjacent face 83 of the cartridge (see Figures 4g and 4h). 
[00167] It will be noted that the second portion 69 of the thin circuit 66 is preferably 
affixed to a region of the exterior surface of the cartridge which, when the cartridge is 
integrated into a printer unit, defines with the components of the printer unit sufficient 
space to accommodate the data processing unit 68. 

[00168] Accordingly, assuming that, when the printer cartridge is integrated into a 
printer unit, the space in front of the external faces of the cartridge is larger in front of 
the face 85 of the cartridge that is opposite the face 83, it is then possible for the 
circuit 66 to extend from the face 83 as far as the opposite face 85 and for the data 
processing unit 68 to be positioned facing that face. 
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[00169] Of course, in this situation, the identification tag 58 must then be positioned 
on another free region of the exterior surface of the printer cartridge. 
[00170] It should be noted that the flexibility of the modules 54 and 58 is optimally 
exploited so that these modules can espouse the available exterior surface of the 
cartridge as closely as possible. 

[00171] Thus the flexibility of each module enables it to adapt to the geometry of the 
cartridges and to the constraints associated with the installation of the cartridges into 
their support in the printer unit. 

[00172] However, in some applications, flexibility of one or both of the two modules 
54 and 58 is not a requirement, and consequently it suffices for the module or 
modules to be thin. 

[00173] Thus the disposition of the thicker portion of the Figure 3 intelligent module 
54 depends on the free space around the printer cartridge when it is installed in a 
printer unit. 

[00174] Note that the Figure 4h, inkjet printer cartridge 46 is equipped with an 
identification module enabling an external device (a source of confidential and/or 
sensitive data) to identify the cartridge, and with an intelligent module, these modules 
each having particular means of making the cartridge secure. 

[00175] Equipment of the above kind affixed to a standard inkjet printer cartridge 
available off the shelf is particularly advantageous in that it does not call into question 
the design of the cartridge or its overall outside dimensions. 

[00176] In the Figure 1 franking machine, the data is made secure firstly by the 
authentication of the print member 46 by the data generating unit 12. 
[00177] To this end, the unit 12 obtains data identifying the print member 46 using 
the wireless communication mode described above. 

[00178] When the central unit 18 of the unit 12 has verified that the print member 46 
is an authorized print member, the module 20 then generates a franking data 
signature using a mathematical method known to the person skilled in the art. The 
encryption circuit 22 of the module 20 then encrypts the signature generated in this 
way, for example using 3DES encryption, which is known to the person skilled in the 
art. 
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[00179] This kind of encryption requires the sender and the receiver to hold different 

encryption keys that are 128 bits long in the case of 3DES encryption. 

[00180] Because decryption is effected in the processing unit 68 of the module 54, a 

key is written into the unit 68 when manufacturing the module 54. 

[00181] This key must also be known to the sender, and therefore contained in the 

encryption circuit 22. 

[00182] The sender 12 uses the key to encrypt the data and the receiver 54 uses it 
to decrypt the data. 

[00183] The key can be programmed when installing the module 54 on the printer 
cartridge or programmed directly into the processing unit 68 during manufacturing of 
the module 54. 

[00184] When the signature is encrypted, the unit 18 associates with it, for example 
concatenates with it, franking data and transmits the whole of the data, which 
constitutes the stream 42, over the communication link 38. 

[00185] Note also that, in the embodiment described, there is no encryption as such 
of the franking data to be printed, although this is of course possible in a different 
embodiment. i 

[00186] Franking data to be printed can additionally be encrypted, which makes the 
exchange of this data between the unit 12 and the printer unit 14 more secure. 
[00187] However, encryption should not be used if it necessitates too great a 
volume of computation, in that the processing unit 68 of the module 54 diverts the 
energy necessary for it to function from the printing control signals reaching it. 
[00188] Figure 5 shows diagrammatically functional units of the Figure 3a data 
processing unit 68. 

[00189] As shown in Figure 5, the data processing unit 68 receives the Figure 1 
stream of printing commands 44 and analyzes it, in particular to authenticate the data 
to be printed. 

[00190] As mentioned above, the energy necessary for the processing unit to 
function is diverted from the stream of printing control signals. 
[00191] The data processing unit could use a microprocessor provided that there is 
no risk of the energy diverted degrading the printing of data. 
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[00192] Thus the processing unit 68 includes a self-powering unit 92 and a clock 
generating unit 94 that supply a particular clock frequency to each of the various units 
described next. 

[00193] A unit 96 extracts the encrypted signature from the stream 44 of printing 
commands reaching the data processing unit 68 and decrypts this signature. 
[00194] This is possible because the encryption key or keys are also known to the 
processing unit 68, because they are programmed either during manufacturing of the 
module 54 or when it is affixed to the print member 46. 
[00195] Decryption is effected by the decryption unit 98. 

[00196] The data processing unit 68 also includes a circuit 99 that includes an 
authentication unit 100 for authenticating the data to be printed on the basis of the 
analysis of the decrypted signature of the franking data. 

[00197] As a matter of fact, when the unit 100 registers the presence of the 
signature of the franking data in the stream of printing commands, this proves the 
authenticity of the data to be printed. 

[00198] Note further that the unit 12 for generating franking data is thereby indirectly 
authenticated by the print member. 

[00199] It is possible to use only one level of verification, and thus to decide to 
authorize the printing of data as soon as the data to be printed has been 
authenticated. 

[00200] A supplementary level of verification can also be provided, by way of the 
unit 102 that verifies the integrity of the data to be printed to check that, even if the 
data comes from an authentic source, it has not been tampered with after leaving the 
source. 

[00201] To this end, tests are applied to the data present in the stream of printing 
commands. 

[00202] When the integrity of the data to be printed has been recognized, then the 
unit 104 authorizes printing of the data. 

[00203] On the other hand, if the data has not been authenticated by the unit 100 or 
the integrity of the authenticated data has not been recognized by the unit 102, then 
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the unit 104 decides either not to authorize printing of the data or to generate an 
erroneous and therefore unusable franking mark. 

[00204] To be more specific, note that the data processing unit 68 first prints a few 
lines of franking data, for example, and then analyzes some of the data extracted from 
the stream of printing commands, after which, as a function of the result of the 
analysis, it can authorize the printing of further lines and again analyze other data 
extracted from the stream of printing commands, and so on. 

[00205] It should be noted that the data processing unit 68 also includes a non- 
volatile memory 106 whose main function is to store the dynamic values of the 
application, for example the cartridge manufacturing date, and the like, and where 
applicable to store values generated by the units 98, 100 and 102. 
[00206] Figure 6 shows in more detail some of the components constituting the 
Figure 5 data processing unit 68. 

[00207] The data processing unit 68 includes a serial receiver unit 108 notably 
including a buffer memory for the intermediate storage of data extracted from the 
stream 44 of printing control signals. 

[00208] As shown, some of the printing control signals are used by unit 92 for self- 
powering the data processing unit 68. 

[00209] A unit 1 10 for analyzing data extracted from the printing control signals and 
combining various functions executed by the units 98, 100, 102 and 104 in Figure 5 
supplies a signal Cmd-decode. 

[00210] A circuit 112 including a logic switch selectively authorizes the passage of a 
signal Xout, on the basis of a printing control signal Xin, as a function of the value of 
the control signal Cmd-decode. 

[00211] The Cmd-decode signal is produced for one or more lines of franking data 
and, for example, authorizes the passing and therefore the printing of a given number 
of lines of franking data that constitute the franking mark. 

[00212] Note that the circuit 112 constitutes a pattern that is repeated several times 
according to the number of signals Xin obtained from the printing control signals. 
[00213] The stream 1 14 of printing commands from the unit 68 is then transmitted to 
the print head 50 to control the print nozzles. 
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[00214] Figure 7 shows diagrammatically the self-powering principle of the Figure 6 
unit 92. 

[00215] Thus the Figure 7 circuit 120 includes a set 122 of m diodes in parallel and 
each receiving one of the control signals Cmd cartridge 0 to Cmd cartridge m, each of 
which corresponds to data specific to one line of the image to be printed. 
[00216] The set 122 of diodes implements an "OR" logic function which therefore 
authorizes the delivery of a signal when its state is 1 . 

[00217] The control signal that is allowed to pass is then filtered in a filter 124 in 
which the values of the components R, C are determined as a function of the value of 
the "load" of the circuit of the unit 68, to allow the accumulation of energy. 
[00218] Figure 8 shows timing diagrams for loading the unit 68. 
[00219] Thus, as shown by the evolution of the output signal Vout of the self- 
powering unit, the latter signal is generated (portion a) by the detection of a first rising 
edge of a control signal Cmd cartridge x. When that control signal goes to 0, the self- 
powering signal Vout loses a little energy (portion b), but the energy level begins to 
rise again (portion c) after the detection of a rising edge of the next control signal Cmd 
cartridge x+k. 

[00220] Note also that the control signals generated by the unit 12 and intended for 
controlling the print head 50 can have an amplitude of the order of 20 V, and the 
processing unit 68 therefore uses a high-voltage technology. 

[00221] The core of the unit 68, which is an application-specific integrated circuit 
(ASIC), for example, operates at a voltage of 3.3 V or 5 V, for example, and 
incorporates memory in the form of RAM or EEPROM. 
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